GitHub Advisoryadvisory · Maven

GHSA-hgjr-xwj3-jfvw JBoss RESTEasy vulnerable to Improper Input Validation

HIGH Published 2022-05-14 Modified 2022-11-22 Official page ↗
Aliases
CVE-2016-9606
Ecosystem
Maven
Packages
org.jboss.resteasy:resteasy-bom
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2022-11-22

Affected packages

• Maven org.jboss.resteasy:resteasy-bom: < 3.1.2.Final → fixed in 3.1.2.Final

Description

JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.

Related

Alias · CVE (1)

  • CVE-2016-9606 JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References